Skip to content

deps: Bump the minor-and-patch group with 37 updates #252

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ivanball merged 3 commits into from
Aug 18, 2026
Merged

deps: Bump the minor-and-patch group with 37 updates #252

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
73bd9fe
deps: Bump the minor-and-patch group with 37 updates
dependabot[bot] Aug 18, 2026
9c5d73c
Merge remote-tracking branch 'origin/main' into dependabot/nuget/mino…
ivanball Aug 18, 2026
76879dc
fix: satisfy MA0075 (Meziantou 3.0.163) in CompactHtml truncation
ivanball Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 37 additions & 37 deletions Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,47 +5,47 @@
<ItemGroup>
<!-- API -->
<PackageVersion Include="Asp.Versioning.Mvc" Version="10.2.1" />
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.10" />
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.11" />
<!-- External OAuth providers for the config-gated AddExternalAuthProviders / OAuthControllerBase (inert without OAuth:*:ClientId). -->
<PackageVersion Include="AspNet.Security.OAuth.GitHub" Version="10.0.0" />
<PackageVersion Include="Microsoft.AspNetCore.Authentication.Google" Version="10.0.10" />
<PackageVersion Include="Microsoft.AspNetCore.Authentication.Google" Version="10.0.11" />
<PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="10.2.1" />
<!-- Supplies the versioning-aware OpenAPI registration (IApiVersioningBuilder.AddOpenApi) and the
MapOpenApi().WithDocumentPerVersion() convention required by the Asp.Versioning 10.2 analyzers
(AV0029/AV0030). -->
<PackageVersion Include="Asp.Versioning.OpenApi" Version="10.2.1" />
<PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
<PackageVersion Include="Asp.Versioning.OpenApi" Version="10.2.2" />
<PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.11" />
<!-- Direct pin to bump the transitive Microsoft.OpenApi off 2.0.0 (pulled by AspNetCore.OpenApi)
to the first patched version for GHSA-v5pm-xwqc-g5wc (circular-schema-reference DoS in OpenAPI
parsing); referenced directly in MMCA.Common.API so the pin takes effect (no transitive pinning). -->
<PackageVersion Include="Microsoft.OpenApi" Version="2.11.0" />
<PackageVersion Include="Microsoft.OpenApi" Version="2.12.0" />
<!-- Application -->
<PackageVersion Include="FluentValidation.DependencyInjectionExtensions" Version="12.1.1" />
<PackageVersion Include="Riok.Mapperly" Version="4.3.1" />
<PackageVersion Include="Microsoft.FeatureManagement" Version="4.6.0" />
<PackageVersion Include="Microsoft.FeatureManagement.AspNetCore" Version="4.6.0" />
<PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
<PackageVersion Include="Scalar.AspNetCore" Version="2.16.18" />
<PackageVersion Include="Scalar.AspNetCore" Version="2.16.20" />
<PackageVersion Include="Scrutor" Version="7.0.0" />
<PackageVersion Include="System.Linq.Dynamic.Core" Version="1.7.3" />
<!-- Infrastructure -->
<PackageVersion Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="10.0.10" />
<PackageVersion Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="10.0.11" />
<!-- Pinned to a patched version to override the vulnerable MessagePack pulled transitively by
SignalR.StackExchangeRedis (2.5.187) and Aspire.Hosting (2.5.192). GHSA-hv8m-jj95-wg3x /
CVE-2026-48109 (high, CVSS 8.2 — LZ4 decompression OOB read); fixed in 2.5.301. Forced via a
direct PackageReference in MMCA.Common.Infrastructure + .Aspire.Hosting (same pattern as
OpenTelemetry.Api below) so the fix flows to consumers through the published package graph. -->
<PackageVersion Include="MessagePack" Version="2.5.302" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Cosmos" Version="10.0.10" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Cosmos" Version="10.0.11" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.11" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.11" />
<!-- Pins the transitive SQLitePCLRaw bundle (EF Core Sqlite floors it at the vulnerable 2.1.11) to
a patched build for GHSA-2m69-gcr7-jv3q / CVE-2025-6965; referenced directly in
MMCA.Common.Infrastructure so the fix flows to consumers through the published package graph
(same pattern as the MessagePack pin above). -->
<PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.5" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.10" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.10" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.11" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.11" />
<PackageVersion Include="MiniProfiler.EntityFrameworkCore" Version="4.5.4" />
<PackageVersion Include="StackExchange.Redis" Version="2.13.17" />
<!-- Two-level cache (L1 in-process + L2 distributed) behind the opt-in AddCommonHybridCache
Expand All @@ -59,7 +59,7 @@
resolves. Projects with the framework reference prune those away, but the ones without it
resolve them as real packages, so the newer pin quietly moves five shared transitives across
the graph for no functional gain. At 10.8.0 this adds exactly one entry per lock file. -->
<PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.8.0" />
<PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.9.0" />
<!-- Cron expression parsing for the opt-in recurring job scheduler (ScheduledJobRunner). MIT,
zero-dependency (netstandard2.0, no transitive graph at all), and it does exactly one thing:
parse a five-field expression and answer "what is the next occurrence after this UTC
Expand Down Expand Up @@ -92,34 +92,34 @@
<!-- Shared DataProtection key ring (MMCA.Common.Aspire.AddCommonDataProtection). Blobs persists
the key ring so every replica decrypts the same auth cookies and antiforgery tokens; Keys is
the optional at-rest encryption of that key ring. Both reuse the Azure.Identity pin above. -->
<PackageVersion Include="Azure.Extensions.AspNetCore.DataProtection.Blobs" Version="1.5.3" />
<PackageVersion Include="Azure.Extensions.AspNetCore.DataProtection.Keys" Version="1.6.3" />
<PackageVersion Include="Azure.Extensions.AspNetCore.DataProtection.Blobs" Version="1.5.4" />
<PackageVersion Include="Azure.Extensions.AspNetCore.DataProtection.Keys" Version="1.6.4" />
<!-- Pinned directly to force transitive resolution to the patched servicing version: the
DataProtection.Blobs/Keys chain otherwise pulls 10.0.7 (five high advisories, NU1903).
Projects with the AspNetCore framework reference prune this away; consumers WITHOUT it
(Aspire AppHosts) resolve the transitive as a real package and need the lifted version. -->
<PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.10" />
<PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.11" />
<!-- Azure Key Vault as a configuration source (MMCA.Common.Aspire.AddCommonKeyVaultConfiguration).
Opt-in and gated on KeyVault:Uri, so an unconfigured host never contacts a vault and local
development stays Azure-free. Reuses the Azure.Identity pin above for the
DefaultAzureCredential the provider authenticates with; the host identity needs the
Key Vault Secrets User role on the vault (samples/deployment/DEPLOYMENT.md, bootstrap step 3). -->
<PackageVersion Include="Azure.Extensions.AspNetCore.Configuration.Secrets" Version="1.5.1" />
<PackageVersion Include="Azure.Extensions.AspNetCore.Configuration.Secrets" Version="1.5.2" />
<!-- gRPC -->
<PackageVersion Include="Google.Protobuf" Version="3.35.1" />
<PackageVersion Include="Grpc.AspNetCore" Version="2.80.0" />
<PackageVersion Include="Grpc.AspNetCore.Server.Reflection" Version="2.83.0" />
<PackageVersion Include="Grpc.Net.ClientFactory" Version="2.83.0" />
<PackageVersion Include="Grpc.Tools" Version="2.82.0" />
<!-- Common.UI -->
<PackageVersion Include="Microsoft.AspNetCore.Components.Authorization" Version="10.0.10" />
<PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.10" />
<PackageVersion Include="Microsoft.AspNetCore.Components.Web" Version="10.0.10" />
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Core" Version="2.3.11" />
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Localization" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.10" />
<PackageVersion Include="Microsoft.AspNetCore.Components.Authorization" Version="10.0.11" />
<PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.11" />
<PackageVersion Include="Microsoft.AspNetCore.Components.Web" Version="10.0.11" />
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Core" Version="2.3.12" />
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.11" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.11" />
<PackageVersion Include="Microsoft.Extensions.Localization" Version="10.0.11" />
<PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.11" />
<PackageVersion Include="MudBlazor" Version="9.8.0" />
<PackageVersion Include="Polly" Version="8.7.0" />
<!-- QR encoding for the shared QrCodeImage component (MIT). Pure managed encode-to-PNG: no
Expand Down Expand Up @@ -150,9 +150,9 @@
binds to the MAUI train: bump together with Microsoft.Maui.Controls. -->
<PackageVersion Include="ZXing.Net.Maui.Controls" Version="0.10.3" />
<!-- Analyzers -->
<PackageVersion Include="Meziantou.Analyzer" Version="3.0.141" />
<PackageVersion Include="Meziantou.Analyzer" Version="3.0.163" />
<PackageVersion Include="Microsoft.VisualStudio.Threading.Analyzers" Version="18.7.23" />
<PackageVersion Include="Roslynator.Analyzers" Version="4.16.0" />
<PackageVersion Include="Roslynator.Analyzers" Version="4.16.1" />
<PackageVersion Include="SonarAnalyzer.CSharp" Version="10.32.0.713" />
<PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
<!-- Testing -->
Expand All @@ -162,11 +162,11 @@
1.4.0, which carries CVE-2026-54570 / GHSA-pgww-w46g-26qg (mXSS via MathML annotation-xml). CPM
does not pin transitives, so the two bUnit-referencing projects add a direct PackageReference. -->
<PackageVersion Include="AngleSharp" Version="1.7.1" />
<PackageVersion Include="Deque.AxeCore.Playwright" Version="4.12.0" />
<PackageVersion Include="Deque.AxeCore.Playwright" Version="4.13.0" />
<!-- Pin the transitive Commons explicitly to 4.12.0 (= Playwright 4.12.0's floor): CPM does not pin
transitives, so a stale-cache restore could otherwise drift it down to 4.7.2 and dirty the lock. -->
<PackageVersion Include="Deque.AxeCore.Commons" Version="4.12.0" />
<PackageVersion Include="Microsoft.Playwright" Version="1.61.0" />
<PackageVersion Include="Deque.AxeCore.Commons" Version="4.13.0" />
<PackageVersion Include="Microsoft.Playwright" Version="1.62.0" />
<!-- Redis integration tier only (Tests/Core/MMCA.Common.Infrastructure.Redis.Tests, outside the
.slnx, own CI job): a real Redis is the only way to assert the storage FORMAT the cache
writes, which a Mock<IDistributedCache> answers for and therefore cannot get wrong.
Expand All @@ -175,8 +175,8 @@
<PackageVersion Include="Testcontainers.Redis" Version="4.8.0" />
<!-- Multi-host cross-service fixture base in MMCA.Common.Testing (Wave 5.8): SQL Server +
RabbitMQ containers for consumer cross-service integration tiers. Test-tier only. -->
<PackageVersion Include="Testcontainers.MsSql" Version="4.13.0" />
<PackageVersion Include="Testcontainers.RabbitMq" Version="4.13.0" />
<PackageVersion Include="Testcontainers.MsSql" Version="4.14.0" />
<PackageVersion Include="Testcontainers.RabbitMq" Version="4.14.0" />
<!-- Pinned directly to force transitive resolution to the patched version: every Testcontainers
package floors SSH.NET at 2025.1.0, which carries GHSA-q939-rpr3-3284 (high, published
2026-08-12: ScpClient recursive download lets a malicious server write arbitrary files via
Expand All @@ -191,27 +191,27 @@
<PackageVersion Include="AwesomeAssertions" Version="9.5.0" />
<!-- Benchmark smoke harness only (Tests/Performance, outside the .slnx) — rubric §12. -->
<PackageVersion Include="BenchmarkDotNet" Version="0.15.8" />
<PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.11" />
<!-- FakeTimeProvider for deterministic clock-driven tests (OutboxCleanupService sweep, session-cookie
expiry); version matches the Microsoft.Extensions dotnet/extensions family (Http.Resilience,
ServiceDiscovery) above. -->
<PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.8.0" />
<PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.9.0" />
<PackageVersion Include="Moq" Version="4.20.72" />
<PackageVersion Include="xunit.v3" Version="3.2.2" />
<PackageVersion Include="xunit.v3.extensibility.core" Version="3.2.2" />
<!-- Shared integration-test scaffolding (MMCA.Common.Testing.SqlServerIntegrationTestFixtureBase):
in-process host boot + throwaway SQL database + Respawn reset. SqlClient matches the version EF
Core SqlServer already resolves transitively so the pin cannot skew the graph. -->
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.10" />
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.11" />
<PackageVersion Include="Microsoft.Data.SqlClient" Version="6.1.6" />
<PackageVersion Include="Respawn" Version="7.0.0" />
<!-- Health Checks -->
<PackageVersion Include="AspNetCore.HealthChecks.Redis" Version="9.0.0" />
<PackageVersion Include="AspNetCore.HealthChecks.Rabbitmq" Version="9.0.0" />
<PackageVersion Include="AspNetCore.HealthChecks.SqlServer" Version="9.0.0" />
<!-- Aspire / ServiceDefaults -->
<PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.8.0" />
<PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.8.0" />
<PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.9.0" />
<PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.9.0" />
<PackageVersion Include="Azure.Monitor.OpenTelemetry.AspNetCore" Version="1.6.0" />
<!-- OpenTelemetry.Api pinned directly to force transitive resolution to non-vulnerable version. -->
<PackageVersion Include="OpenTelemetry.Api" Version="1.17.0" />
Expand Down
14 changes: 7 additions & 7 deletions Source/Core/MMCA.Common.Application/packages.lock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,9 @@
},
"Meziantou.Analyzer": {
"type": "Direct",
"requested": "[3.0.141, )",
"resolved": "3.0.141",
"contentHash": "p0mtUYG/36FEnU6P5GovB82mVH4DoWGdHYjePkLnIeTNI0LQfmvjGj2twQEBTosw6/YTTnk8Fknu2VvaFybECA=="
"requested": "[3.0.163, )",
"resolved": "3.0.163",
"contentHash": "l9iZ+OXBGlAFEKH1y4BSKPXHcmpJmikysSm0brjTau8fR7Qm7IVGLVig+dh0RH9mq4s3neZayuPQrHRweOpxxw=="
},
"Microsoft.FeatureManagement": {
"type": "Direct",
Expand Down Expand Up @@ -60,9 +60,9 @@
},
"Roslynator.Analyzers": {
"type": "Direct",
"requested": "[4.16.0, )",
"resolved": "4.16.0",
"contentHash": "/EZ1HVILd9jPdXquT03vBawvAuGNotmf+r/GBiVfPj9BdUyn/olOdjF9BqqjIK5Cyq3pdBDL/qMuJEGtBLMaZA=="
"requested": "[4.16.1, )",
"resolved": "4.16.1",
"contentHash": "AGzq3UZvIwTGSh9xyIna+Q9F666S8UaLlX/Pk3Iz21qIAWjL8iYporVCcX1k/oi5chrRZ8VJRahup4me4HZptw=="
},
"Scrutor": {
"type": "Direct",
Expand Down Expand Up @@ -224,7 +224,7 @@
},
"Microsoft.Extensions.Configuration.Abstractions": {
"type": "CentralTransitive",
"requested": "[10.0.10, )",
"requested": "[10.0.11, )",
"resolved": "8.0.0",
"contentHash": "3lE/iLSutpgX1CC0NOW70FJoGARRHbyKmG7dc0klnUZ9Dd9hS6N/POPWhKhMLCEuNN5nXEY5agmlFtH562vqhQ==",
"dependencies": {
Expand Down
12 changes: 6 additions & 6 deletions Source/Core/MMCA.Common.Domain/packages.lock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,9 @@
"net10.0": {
"Meziantou.Analyzer": {
"type": "Direct",
"requested": "[3.0.141, )",
"resolved": "3.0.141",
"contentHash": "p0mtUYG/36FEnU6P5GovB82mVH4DoWGdHYjePkLnIeTNI0LQfmvjGj2twQEBTosw6/YTTnk8Fknu2VvaFybECA=="
"requested": "[3.0.163, )",
"resolved": "3.0.163",
"contentHash": "l9iZ+OXBGlAFEKH1y4BSKPXHcmpJmikysSm0brjTau8fR7Qm7IVGLVig+dh0RH9mq4s3neZayuPQrHRweOpxxw=="
},
"Microsoft.VisualStudio.Threading.Analyzers": {
"type": "Direct",
Expand All @@ -22,9 +22,9 @@
},
"Roslynator.Analyzers": {
"type": "Direct",
"requested": "[4.16.0, )",
"resolved": "4.16.0",
"contentHash": "/EZ1HVILd9jPdXquT03vBawvAuGNotmf+r/GBiVfPj9BdUyn/olOdjF9BqqjIK5Cyq3pdBDL/qMuJEGtBLMaZA=="
"requested": "[4.16.1, )",
"resolved": "4.16.1",
"contentHash": "AGzq3UZvIwTGSh9xyIna+Q9F666S8UaLlX/Pk3Iz21qIAWjL8iYporVCcX1k/oi5chrRZ8VJRahup4me4HZptw=="
},
"SonarAnalyzer.CSharp": {
"type": "Direct",
Expand Down
Loading